feat(agent): semantic control mapping — embedding index + region->control retrieval #215

Merged

sharang merged 2 commits from feat/semantic-control-mapping into main 2026-07-21 10:50:22 +00:00

Conversation 0 Commits 2 Files Changed 5

+365 -33

sharang commented 2026-07-21 10:35:54 +00:00

Owner

Copy Link

Copy Source

What

The scale mechanism for mapping findings to the master-control corpus (~13.6k), which carries no CWE — so we map by similarity + grounded judgment (Vul-RAG style), not a CWE-LUT.

Pieces

• ControlIndex — embeds each control's requirement text; nearest(region_embedding, k) returns the top-K controls by cosine.
• SemanticControlChecker — retrieve top-K → judge each with the grounded judge → ground → control_refs. The region → controls direction is what scales: the LLM judges a handful of candidates, not 13.6k, and every survivor is still anchored to real code by the grounding gate.

Reuses the existing judge + grounding gate. Stub-tested (cosine ranking, retrieve→ground, ungrounded-dropped).

Not yet wired

Integration into the scan (build the index from the master-controls catalog, embed each finding's region, stamp master-control refs) + the live test wait for breakpilot #129 (the master-controls OSCAL export) to deploy.

Testing

clippy -D warnings + cargo fmt --all --check + CI test cmd (302 + 52 + 4 + 27) green.

## What The scale mechanism for mapping findings to the **master-control corpus (~13.6k)**, which carries **no CWE** — so we map by *similarity + grounded judgment* (Vul-RAG style), not a CWE-LUT. ## Pieces - **`ControlIndex`** — embeds each control's requirement text; `nearest(region_embedding, k)` returns the top-K controls by cosine. - **`SemanticControlChecker`** — retrieve top-K → judge each with the grounded judge → ground → `control_refs`. The `region → controls` direction is what scales: the LLM judges a handful of candidates, not 13.6k, and every survivor is still anchored to real code by the grounding gate. Reuses the existing judge + grounding gate. Stub-tested (cosine ranking, retrieve→ground, ungrounded-dropped). ## Not yet wired Integration into the scan (build the index from the master-controls catalog, embed each finding's region, stamp master-control refs) + the live test wait for **breakpilot #129** (the master-controls OSCAL export) to deploy. ## Testing `clippy -D warnings` + `cargo fmt --all --check` + CI test cmd (**302 + 52 + 4 + 27**) green.

sharang added 1 commit 2026-07-21 10:35:55 +00:00

feat(agent): semantic control mapping — embedding index + region->control retrieval ... 30487e4d8f

The scale mechanism for the master-control corpus (which carries no CWE to LUT
on): ControlIndex embeds each control's requirement text and returns the top-K
nearest to a code region (cosine); SemanticControlChecker retrieves those K,
judges each with the grounded judge, and grounds the verdicts -> control_refs.

The region->control direction (vs the CWE-LUT's finding->control) is what scales
to ~13.6k: the LLM only ever judges a handful of retrieved candidates, and every
survivor is still anchored to real code by the grounding gate. Reuses judge +
ground gate. Stub-tested (cosine ranking, retrieve->ground, ungrounded dropped).

Not yet wired into the scan (needs the master-controls catalog live, breakpilot #129).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang added 1 commit 2026-07-21 10:44:00 +00:00

feat(agent): C4 — semantic_stamp_findings + provider load_master_controls ... 95c18e7683

Wires the semantic mapping into a callable scan pass:
- OscalControlsProvider: token-based fetch refactor + load_master_controls()
  (pulls ?framework=master-controls)
- semantic_stamp_findings(): build the ControlIndex from the master-controls
  catalog, then per finding embed its code region, retrieve the top-K nearest
  master controls, grounded-judge confirm, and stamp the confirmed ids onto
  control_refs (alongside the CRA CWE-LUT refs).

Opt-in — the orchestrator doesn't auto-run it, and it rebuilds the corpus index
per call (production should cache it). Live-verifiable once breakpilot #129 deploys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit f516ecf3b5 into main 2026-07-21 10:50:22 +00:00

sharang referenced this pull request 2026-07-21 11:12:16 +00:00

feat(agent): cache control embedding index + auto-wire semantic pass (gated) #217

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0-demo

CERTifAI P0 demo build tickets (CS-*)

bug

critical

enhancement

epic

Tracking issue spanning multiple sub-issues

high

infrastructure

onboarding

Multi-target onboarding wizard redesign

performance

security

v0.3.0

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Benjamin_Boenisch sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#215